qa/tasks/qemu: get the new Let's Encrypt root certificate

Fixes: https://tracker.ceph.com/issues/53841
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
(cherry picked from commit b47965b5773d086eb64e7f91bdc05f483f562b00)

diff --git a/qa/tasks/userdata_setup.yaml b/qa/tasks/userdata_setup.yaml
index 9aa2d0396713c8c9d5e9ff1d9378e047a1e60ae0..afcc08e22a3c30143bd6d70170e0fb3e18babd17 100644 (file)
--- a/qa/tasks/userdata_setup.yaml
+++ b/qa/tasks/userdata_setup.yaml
@@ -17,6 +17,15 @@
   sed -i 's/archive.ubuntu.com/old-releases.ubuntu.com/' /etc/apt/sources.list
   sed -i 's/security.ubuntu.com/old-releases.ubuntu.com/' /etc/apt/sources.list
   apt-get update
+
+  # DST Root CA X3 certificate expired on Sep 30, 2021.  It was used by
+  # Let's Encrypt, which is what git.ceph.com relies on for HTTPS.  Get the
+  # new Let's Encrypt root certificate in place and deactivate the old one
+  # (lines that begin with "!" are deselected).
+  apt-get install --only-upgrade ca-certificates libssl1.0.0
+  sed -i 's/mozilla\/DST_Root_CA_X3\.crt/!mozilla\/DST_Root_CA_X3\.crt/' /etc/ca-certificates.conf
+  update-ca-certificates
+
   apt-get -y install nfs-common
   mkdir /mnt/log
   # 10.0.2.2 is the host